The forms were the policy

Think about what a form actually did. It decided which fields you had to fill in, which values were allowed in each one, which records you were allowed to touch and what order the steps happened in. Press submit and every one of those rules got checked.

And whatever the form did not offer, you could not do at all. Whole categories of action were ruled out by there being no screen for them.

Almost none of that was ever written down as a rule. It was the shape of the application, and the shape was doing the enforcing.

That is worth sitting with, because it means the policy was completely real and nobody had ever read it. It lived in the interface as a side effect of building the interface. Every screen somebody chose not to build was a rule that nobody wrote.

Expose everything as a tool and that implicit policy is gone. A hundred deliberate forms become a thousand arbitrary combinations. The only thing left standing between the agent and the data is the policy somebody actually declared.

Policy is not new. It used to live in the interface. Now it has to be written down.

The awkward part is that nobody has the list. Go looking for the rules your application enforces and you will not find a document, you will find screens. Working out what the rules actually were is archaeology, and it is the first real piece of work rather than something to get out of the way before it.

You cannot skip it by being careful at the agent layer either, because the agent layer does not know what it does not know.

When capability is free, the only design decision left is restraint.